This is wrong because clone() has protected access in Object,
and calling clone() on any object will not compile, unless the object has overridden the method.
I few (very few) pieces moved elsewhere. Most of the material is out of scope for the Java 17 cert. I'm not sad though. A lot of the stuff it covered for security wasn't useful in practice. It's tough because most of the interesting security material involves third party libraries or server side Java.